Dual System Encryption: Realizing IBE and HIBE from Simple Assumptions Brent Waters

2 Identity-Based Encryption [S84,BF01,C01] Public ParamsMSK ID’ ID Authority Decrypt iff ID’ = ID

IBE Security [BF01] Challenger M 0, M 1, ID *  ID i (challenge ID) Attacker Public Params ID 1 … ID Q bEnc(M b, PP, ID * ) b’ Adv = Pr[b’=b] -1/2

IBE Security Proofs  “Partitioning” [BF01, C01, CHK03, BB04, W05] Simulator Challenge Space ID Space Priv. Key Space  2 Goals:  Answer Attacker Queries  Use Attacker Response Attacker

Partitioning and Aborts Simulator ID Space Priv. Key Space Challenge Space ID 1 ID 2 … … ID Q ID * (challenge ID)  Attacker Abort and try again

Finding a Balance Simulator Challenge Space ID Space Priv. Key Space  Aborts effect security loss  Challenge Space -> “right size”  C.S. = 1/Q (for Q queries ) => 1/Q no abort

Structure gives problems!  Hierarchical IBE  Q queries per HIBE level => (1/Q) depth loss  Attribute-Based Encryption similar :edu :gov Partitioning won’t work!

The Gentry Approach [G06,GH09]  Ready for both  Shove degree Q poly into Short params => Complex Assumption

Our Results  IBE (w/ short parameters)  HIBE  Broadcast Encryption  Full Security  Simple Assumption: Decision Linear Given: g, u, v, g a, u b, Dist: v a+b from R

Dual System Encryption  2 types of Keys & CTs ID Normal ID Semi-Functional ID Normal Semi-Functional Used in real system ID  Types are indist. (with a caveat)

Principles Simulator  No aborts  Change things slowly  Hybrid over keys form  Goal: Everything Semi Functional I’m ready for anything!

Proof Overview – 3 Steps Simulator 1)Challenge CT  Semi Func. 2)Keys  Semi. Func. (one at a time!!) 3)Argue Security ID 1 ID 2 … ID Q ID * ID 1 ID 2 ID Q ID

Problem: Simulator can test keys! Simulator  Create S.F. CT for “Bob” and unknown key for “Bob”  Decryption works iff key is normal “Bob” ?

Resolution: Tweak Semantics  Add “tags” t c, t k to C.T. and Key  Decrypt iff ID c = ID k AND t c  t k  Negl. correctness error (can patch)  SW08 revocation ID c, t c ID K, t K

Problem: Simulator can test keys! Simulator  Sim. Picks A, B 2 Z p : F(ID) = A ¢ ID + B  Challenge CT and unknown key tags  F(ID) “Bob”, t k =x ? “Bob”, t c =x  Dec. Fails regardless of Semi Functionality!  2 different IDs look independent  Hybrid  simple assumption

How it is built  Subgroup version N= p 1 p 2 p 3 ID Normal ID Normal S.F. ID S.F. p2p2 p1p1 p3p3

Glimpse of Subgroup Construction Setup:  Similarities to Boneh-Boyen04  D. Linear same concepts, more messy KeyGen(ID): Encrypt(ID,M):

Conclusions and Speculation  Dual Encryption: Change Forms First!  One by one  Small Assumptions  HIBE, B.E. became easier  Prediction: ABE + Functional Enc.  Need new techniques  Prediction: Simple Assumptions & Full Security

Dual Interpretation Selective Security + Assumptions were bad  Not ultimately necessary Interpretation 1: They lead us in the right directions  Full secure schemes “look like” selective  Gentry06 beyond partitioning Alternative:

20 Thank you

The Gentry Approach [G06,GH09]  Ready for both  Simulator 1-key per identity – always looks good  Shove degree Q poly into Short params => Complex Assumption